diff options
| author | Lukasz Kasprzak <lukasz.kasprzak@pm.me> | 2026-04-14 22:32:43 +0200 |
|---|---|---|
| committer | Lukasz Kasprzak <lukasz.kasprzak@pm.me> | 2026-04-14 22:32:43 +0200 |
| commit | 83f7fe4b8402bab171d110703a1b1115efbc9b28 (patch) | |
| tree | 19110702c7d740f6bd8ee4f5d2ebcb97442be237 /straper/db/public/kernel/sysctl.d/99-hardening.conf | |
| parent | 51d43498b07dc97d795947964534f0903cd05db5 (diff) | |
| download | bin-83f7fe4b8402bab171d110703a1b1115efbc9b28.tar.gz bin-83f7fe4b8402bab171d110703a1b1115efbc9b28.zip | |
cleaned up many scrits and deleted some that were of no use; renamed a lot
Diffstat (limited to 'straper/db/public/kernel/sysctl.d/99-hardening.conf')
| -rw-r--r-- | straper/db/public/kernel/sysctl.d/99-hardening.conf | 54 |
1 files changed, 0 insertions, 54 deletions
diff --git a/straper/db/public/kernel/sysctl.d/99-hardening.conf b/straper/db/public/kernel/sysctl.d/99-hardening.conf deleted file mode 100644 index 87d036c..0000000 --- a/straper/db/public/kernel/sysctl.d/99-hardening.conf +++ /dev/null @@ -1,54 +0,0 @@ -# ---------------------------- -# Kernel hardening baseline -# ---------------------------- - -# Kernel pointer & info leaks -kernel.kptr_restrict = 2 -kernel.dmesg_restrict = 1 -kernel.perf_event_paranoid = 3 - -# Protect against memory corruption exploits -kernel.randomize_va_space = 2 -vm.mmap_min_addr = 65536 - -# Disable magic SysRq -kernel.sysrq = 0 - -# Restrict kernel logs -kernel.printk = 3 3 3 3 - -# Protect links & proc -fs.protected_hardlinks = 1 -fs.protected_symlinks = 1 -fs.protected_fifos = 2 -fs.protected_regular = 2 - -# Disable unprivileged user namespaces (major exploit class) -kernel.unprivileged_userns_clone = 0 - -# Block ptrace attacks -kernel.yama.ptrace_scope = 2 - -# Networking hardening -net.ipv4.conf.all.accept_redirects = 0 -net.ipv4.conf.default.accept_redirects = 0 -net.ipv4.conf.all.send_redirects = 0 -net.ipv4.conf.default.send_redirects = 0 -net.ipv4.conf.all.accept_source_route = 0 -net.ipv4.conf.default.accept_source_route = 0 -net.ipv4.conf.all.log_martians = 1 -net.ipv4.conf.default.log_martians = 1 -net.ipv4.icmp_ignore_bogus_error_responses = 1 -net.ipv4.tcp_syncookies = 1 - -# NAT compatibility -net.ipv4.conf.all.rp_filter = 0 -net.ipv4.conf.default.rp_filter = 0 -net.ipv4.conf.enx00e04c2e4828.rp_filter = 0 - -# Disable unprivileged BPF -kernel.unprivileged_bpf_disabled = 1 - -# Restrict kernel tracing -kernel.ftrace_enabled = 0 - |